Implement read-only schedule sharing and revocation #18

New issue

Open

opened 2026-11-07 20:27:04 +00:00 by etashj · 0 comments

etashj commented

2026-11-07 20:27:04 +00:00

Member

Goal

Allow schedule owners to share a read-only view and revoke it. The sharing handlers in personal.rs currently return 501.

Scope

Implement POST/DELETE /api/schedules/{id}/share and GET /api/shared-schedules/{id} against the retained personal schema.
Require owner authentication for share/revoke, return only fields allowed by the frontend contract to viewers, and enforce revocation immediately.
Prevent access to another user’s unshared schedule and validate unknown or malformed IDs.
Add OpenAPI coverage and tests for creation, read-only access, revocation, and cross-user access.

Done when

An owner can create and revoke a share link; the shared view works while active and stops working after revocation. Update feature documentation.

Depends on schedule CRUD (#16). See sites/docs/src/backend-development.md and sites/docs/src/api/user.md.

## Goal Allow schedule owners to share a read-only view and revoke it. The sharing handlers in `personal.rs` currently return 501. ## Scope - Implement `POST/DELETE /api/schedules/{id}/share` and `GET /api/shared-schedules/{id}` against the retained personal schema. - Require owner authentication for share/revoke, return only fields allowed by the frontend contract to viewers, and enforce revocation immediately. - Prevent access to another user’s unshared schedule and validate unknown or malformed IDs. - Add OpenAPI coverage and tests for creation, read-only access, revocation, and cross-user access. ## Done when An owner can create and revoke a share link; the shared view works while active and stops working after revocation. Update feature documentation. Depends on schedule CRUD (#16). See `sites/docs/src/backend-development.md` and `sites/docs/src/api/user.md`.